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DETAILED ACTION 
Continued Examination Under 37 CFR LI 14 

1 . A request for continued examination under 37 CFR 1.114, including the fee set forth in 
37 CFR 1.17(e), was filed in this application after final rejection. Since this application is 
eligible for continued examination under 37 CFR 1.1 14, and the fee set forth in 37 CFR 1.17(e) 
has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 
37 CFR 1.114. Applicant's submission filed on 12/09/2004 has been entered. 

2. The following is a non-final office action in response to the request for continued 
examination received on 12/09/2004. Claims 1, 10, 14, and 16 have been amended. Claims 1-18 
are now pending in this Application. 

Response to Amendment 

3. Applicant's amendments to claims 10 and 14 are sufficient to overcome the claim 
objections set forth in the previous office action. 

Claim Rejections - 35 USC § 102 

4. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in a patent granted on an application for patent by another filed in the United 
States before the invention thereof by the applicant for patent, or on an international application by another who 
has fulfilled the requirements of paragraphs (1), (2), and (4) of section 371(c) of this title before the invention 
thereof by the applicant for patent. 

The changes made to 35 U.S.C. 102(e) by the American Inventors Protection Act of 1999 
(AIPA) do not apply to the examination of this application as the application being examined 
was not (1) filed on or after November 29, 2000, or (2) voluntarily published under 35 U.S.C. 
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122(b). Therefore, this application is examined under 35 U.S.C. 102(e) prior to the amendment 
by the AIPA (pre-AIPA 35 U.S.C. 102(e)). 

4. Claims 1-18 are rejected under 35 U.S.C. 102(e) as being anticipated by Ibarra (U.S. 
6,119,097). 

5. As per claim 1, Ibarra teaches a method for determining compliance with organizational 
business policies associated with a business risk, said method comprising: 

a. the computer receiving a user selection of business risk elements, said business 
risk elements being retrieved from a database coupled to said computer (See column 4, 
lines 15-45, column 6, lines 1-5 and 15-25, and column 10, lines 3-25, wherein the 
computer receives a user selection of business risk elements associated with employees 
and employee turnover); 

b. for each business risk element, the computer retrieving one or more 
predetermined control procedures, the control procedures identified by an administrator 
as a means for complying with business policies associated with said risk element (See 
column 2, lines 35-65, column 3, lines 1-15, column 4, lines 15-22 and 40-50, column 8, 
lines 50-67, and column 9, lines 1-5, which discuss compliance procedures associated 
with elements of the business and job with which the employees must comply); 

c. the computer associating said one or more predetermined control procedures with 
said business risk element, said predetermined control procedures being stored in said 
database (See column 2, lines 35-65, column 3, lines 1-10, column 4, lines 15-22 and 40- 
65, column 6, lines 1-20, where the control procedures (i.e. activities, items) are 
associated with a specific element (i.e. category)); 
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d. the computer retrieving a weight assigned to each one of said predetermined 
control procedures, said weight being stored in said database (See at least column 5, lines 
1-10, column 9, lines 1-15, which discloses weights being associated with the procedures. 
The control procedures receive equal weighting in the disclosed embodiment. Ibarra also 
discusses the minimum acceptable, expected, and outstanding score levels associated 
with compliance, and using these scores to measure the performance of the employee 
with respect to a control procedure); 

e. the computer receiving a user selection of a compliance rating for each said 
predetermined control procedure, the rating selected by the user indicating a level of 
compliance with each one of said predetermined control procedures, for each of said 
predetermined control procedures the level of compliance is selected from a rigid set of 
compliance ratings, the same set of compliance ratings is available for each of said 
predetermined control procedures (See figure 6 and column 2, lines 50-65, column 3, 
lines 1-15, column 5, lines 1-11, column 6, lines 53-60, column 8, lines 45-67, column 9, 
lines 1-20, wherein Ibarra discloses tracking an employees compliance with objective 
activities within the business so as to improve employee performance and reduce the 
risks of turnovers. Compliance ratings are selected from the rigid set of not applicable, 
outstanding, below average, etc.); and 

f. the computer calculating a compliance score, each compliance score being a 
function of said assigned weights and said compliance rating of said predetermined 
control procedures (See column 2, lines 50-65, column 3, lines 1-15, column 5, lines 1- 
11, column 6, lines 53-60, column 8, lines 45-67, column 9, lines 1-20, wherein the 
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computer calculates a compliance rating. The computer considers the equal weights 
when determining the average and also considers the three compliance score levels when 
determining the compliance rating). 

6. As per claim 2, Ibarra teaches a method wherein said compliance ratings comprise at 
least one rating identifying a non-fully compliant control procedure, said method further 
comprising the steps of: 

a. for each said control procedure having a non-fully compliant rating, the computer 
receiving a user generated signal indicating whether said non-fully compliant control 
procedure is accepted or not accepted (See column 4, lines 50-65, column 5, lines 1-25 
and 35-40, column 6, lines 50-67, column 7, lines 1-13 and 30-50, wherein noncompliant 
control procedures are indicated as not accepted); and 

b. for each of said non-fully compliant control procedure which is indicated as not 
accepted, requiring the user to provide signals for generating an action plan (See at least 
column 3, lines 1-15, column 4, lines 50-65, column 5, lines 1-30, column 6, lines 50-67, 
column 7, lines 1-13 and 30-50, wherein an action plan concerning the noncompliant 
control procedure is created by a problem solving session that generates action steps). 

7. As per claim 3, Ibarra teaches wherein said action plan includes a target date, said 
method further comprising the step of the computer calculating an expected compliance score for 
one or more future dates based on said action plan target dates (See at least figure 10, column 3, 
lines 1-15, column 4, lines 50-65, column 5, lines 1-40, column 6, lines 50-67, column 7, lines 1- 
13 and 30-50, which discloses a target date, trend data, and an expected successful score). 
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8. As per claim 4, Ibarra discloses a method further comprising the step of the computer 
tracking whether said expected compliance scores have been met, said tracking including 
calculating actual compliance scores for said target dates (See at least figure 10, column 3, lines 
1-15, column 4, lines 50-65, column 5, lines 1-30, column 7, lines 1-13 and 30-50, column 9, 
lines 10-20 and 55-65, wherein the computer tracks the compliance scores associated with the 
target dates for the employees). 

9. As per claim 5, Ibarra discloses a method further comprising the step of the computer 
displaying said expected compliance scores versus said actual compliance for the target dates 
(See figures 8-10, column 4, lines 15-22 and 40-65, column 6, lines 1-20, column 9, lines 30-65, 
and column 10, lines 25-60, wherein the computer displays expected scores versus actual scores. 
See in figure 8, for example, where the line is the expectation and the stars mark the 
performance). 

10. As per claim 6, Ibarra teaches a method further comprising the step of the computer 
associating one or more parameters with each said compliance rating (See column 2, lines 35-65, 
column 3, lines 1-10, column 4, lines 15-22 and 40-65, column 6, lines 1-20, column 9, lines 30- 
65, which discusses parameters associated with the ratings). 

11. As per claim 7, Ibarra teaches wherein said one or more parameters are selected from the 
group comprising organization, business line, process, and region (See column 2, lines 35-65, 
column 3, lines 1-10, column 4, lines 15-22 and 40-65, column 6, lines 1-20, column 9, lines 30- 
65, wherein the parameters are associated with the organization and/or process). 

12. As per claim 8, Ibarra teaches a method further comprising the step of the computer 
sorting said compliance scores by said one or more parameters (See column 4, lines 15-22 and 
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40-65, column 6, lines 1-20, column 9, lines 30-65, wherein the computer sorts the scores using 
organizational parameters). 

13. As per claim 9, Ibarra discloses a method further comprising the step of the computer 
displaying said sorted compliance scores (See, column 4, lines 15-22 and 40-65, column 6, lines 
1-20, column 9, lines 30-65, wherein the computer displays the data). 

14. As per claim 10, Ibarra teaches a method for determining compliance with organizational 
business policies associated with a business risk, said method comprising: 

a. a computer receiving a user selection of a business risk element, said risk element 
being retrieved from a database coupled to said computer (See column 4, lines 15-45, 
column 6, lines 1-5 and 15-25, column 8, lines 40-65, column 9, lines 1-15, and column 
10, lines 3-25, wherein the computer receives a selection of categories that are factors 
that contribute to employee performance and the possibility or risk of employees not 
complying with business standards. An example of a risk element is the category of "job 
and technical knowledge"); 

b. the computer identifying one or more subrisk elements associated with said 
business risk elements, each subrisk element being retrieved from said database (See 
column 4, lines 15-45, column 6, lines 1-5 and 15-25, column 8, lines 40-65, column 9, 
lines 1-15, and column 10, lines 3-25, wherein the sub-elements are retrieved. Sub- 
elements are associated with elements, such as the sub-elements of "knows all aspects of 
the job" and "adheres to policies and standards" associated with the element "job and 
technical knowledge"); 
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c. for at least one subrisk element, the computer retrieving one or more 
predetermined control procedures, the control procedures identified by an administrator 
as a means for business policies associated with said subrisk element (See column 2, lines 
35-65, column 3, lines 1-15, column 4, lines 15-22 and 40-50, column 8, lines 50-67, and 
column 9, lines 1-5, which discuss compliance procedures associated with sub-elements 
of the business and job with which the employees must comply); 

d. the computer associating said one or more control procedures with said subrisk 
element, said control procedures being stored in said database (See column 2, lines 35-65, 
column 3, lines 1-10, column 4, lines 15-22 and 40-65, column 6, lines 1-20, where the 
control procedures are associated with sub elements); 

e. the computer retrieving a weight assigned to each one of said predetermined 
control procedures, said weight being stored in said database (See at least column 5, lines 
1-10, column 9, lines 1-15, which discloses weights being associated with the 
procedures); 

f. the computer receiving a user selection of a compliance rating for each said 
predetermined control procedure, each said compliance rating selected from a rigid 
predetermined set of compliance ratings, the same set of compliance rating is available 
for each of said predetermined control procedures including at least one rating indicating 
said control procedure is not fully compliant (See figure 6 and column 2, lines 50-65, 
column 3, lines 1-15, column 5, lines 1-1 1, column 6, lines 53-60, column 8, lines 45-67, 
column 9, lines 1-20, wherein compliance ratings are selected from the rigid set of not 
applicable, outstanding, below average, etc.); 
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g. the computer calculating a compliance score, said compliance score being a 
function of said assigned weights and said compliance rating of said control procedures 
(See column 2, lines 50-65, column 3, lines 1-15, column 5, lines 1-11, column 6, lines 
53-60, column 8, lines 45-67, column 9, lines 1-20, wherein the computer calculates a 
compliance rating); 

h. for each subrisk, the computer determining whether at least one control procedure 
associated with said subrisk is not fully compliant (See column 4, lines 50-65, column 5, 
lines 1-30, column 6, lines 50-67, column 7, lines 1-13 and 30-50, wherein control 
procedures are noncompliant); 

i. for each subrisk associated with at least one control procedure which is not fully 
compliant, the computer receiving a signal from the user indicating whether said subrisk 
should be accepted or not accepted (See column 4, lines 50-65, column 5, lines 1-25 and 
35-40, column 6, lines 50-67, column 7, lines 1-13 and 30-50); and 

j . for each subrisk which is indicated as not accepted, the computer generating an 
action plan (See at least column 3, lines 1-15, column 4, lines 50-65, column 5, lines 1- 
30, column 6, lines 50-67, column 7, lines 1-13 and 30-50, wherein an action plan 
concerning the noncompliant control procedure is created by a problem solving session 
that generates action steps). 

15. Claims 11,12, and 13 contain equivalent limitations to claims 3, 6, and 8, respectively, 
and are therefore rejected using the art and rationale as applied above. 

16. Claim 14 is substantially similar to claims 1 and 2 above and is therefore rejected using 
the same art and rationale as applied above. Furthermore, Ibarra discloses (g) the computer 
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calculating an expected compliance score for a future date, said expected compliance score being 
a function of said assigned weights, said fully compliant control procedures, and said action plan 
target dates for said non-fiilly complaint control procedures (See at least column 3, lines 1-15, 
column 4, lines 50-65, column 5, lines 1-30, column 6, lines 50-67, column 7, lines 1-13 and 30- 
50, which discusses target dates and trend data). 

17. As per claim 15, Ibarra teaches wherein said action plan comprises a signal indicating 
whether said non-fully compliant rating is accepted or not accepted, said expected compliance 
score further being a function of said non-fully compliant ratings which have been accepted (See 
at least figure 10, column 3, lines 1-15, column 4, lines 50-65, column 5, lines 1-40, column 6, 
lines 50-67, column 7, lines 1-13 and 30-50, which discloses creating action plans for those non- 
fully compliant ratings). 

18. Claim 16 is substantially similar to claim 1 above and is therefore rejected using the same 
art and rationale as applied above. Furthermore, Ibarra teaches a database and a processor 
coupled to the database (See at least figure 13, column 6, lines 1-25 and 50-60, column 9, lines 
30-61, and column 10, lines 10-30 and 40-60). 

19. Claim 17 is substantially similar to claim 2 above and is therefore rejected using the same 
art and rationale as applied above. Furthermore, Ibarra teaches an expected compliance score 
and (c) the computer generating one or more future expected compliance scores, said compliance 
scores being a function of said target dates, said assigned weights, and said expected compliance 
rating of said control procedures (See at least column 3, lines 1-15, column 4, lines 50-65, 
column 5, lines 1-30, column 6, lines 50-67, column 7, lines 1-13 and 30-50, wherein an 
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expected compliance score of meeting the standard is generated based on the action plan 
determined. The action plan has a target date, weights, etc.). 

20. As per claim 18, Ibarra teaches a data processing system further comprising a computer 
display coupled to said processor, said processor further being programmed to display said 
compliance scores on a computer display (See, column 4, lines 15-22 and 40-65, column 6, lines 
1-20, column 9, lines 30-65, wherein the computer displays the data). 

Response to Arguments 

21 . Applicant's arguments with respect to the claims have been considered but are moot in 
view of the new grounds of rejection, as necessitated by amendment. 

Conclusion 

The prior art made of record and not relied upon is considered pertinent to applicant's 
disclosure. 

Barrett et al. (U.S. 6,029,144) teaches a compliance system for comparing a business 
action against stored standards. 

Ruffin et al. (U.S. 6,675,149) teaches prioritizing a set of objectives associated with a 
business, scoring these characteristics against desired information, weighting, and ranking. 

Baseman et al. (U.S. 6,671,673) discloses monitoring performance measures of an 
enterprise to maximize revenue and minimize risk. 

Canada et al. (U.S. 6,757,660) discloses evaluating the importance of characteristics in an 
objective assessment. 



Application/Control Number: 09/545,381 



Page 12 



Art Unit: 3623 

"Compliance: An exercise in Risk Management" (Compliance Action) teaches using risk 
as an audit tool to determine the compliance of a bank business. 

PriceWaterhouseCoopers (pwcglobal.com) discloses proactive risk management 
including compliance risk management, strategic risk management, etc. 

Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Beth Van Doren whose telephone number is (703) 305-3882. 
The examiner can normally be reached on M-F, 8:30-5:00. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Tariq Hafiz can be reached on (703) 305-9643. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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January 28, 2005 




SUSANNA M. DIAZ 
PRIMARY EXAMINER 



